EUVD-2026-99822
GHSA-p8f3-wwp6-9v5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel workbook
-
DeliveryDeliver via phishing email or download
-
ExploitVictim opens file triggering heap overflow
-
ExecutionExecute arbitrary code as current user
-
ImpactEstablish foothold on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open (or preview) an attacker-crafted Excel file that triggers the heap-based buffer overflow in the Office parser - this user-interaction requirement (UI:R) is the primary limiting factor and means the attack depends on social engineering (phishing attachment or malicious download) rather than unattended remote compromise. No authentication or special privileges are needed on the target (PR:N), and the affected products are default Excel installations across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac, and Office Online Server, so no non-default configuration is required beyond having Excel installed. Code executes with the privileges of the user who opens the file, so lower-privileged user accounts constrain post-exploitation impact. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw with full confidentiality/integrity/availability impact, gated only by user interaction (opening a crafted Excel file). The single mitigating factor is UI:R - a user must open or preview a malicious workbook - which moves this from a wormable server-side bug to a client-side, social-engineering-dependent attack (phishing attachment, malicious download). Critically, several exploitation-pressure signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no POC indicator are provided, so exploitation probability cannot be quantified from this data. The absence of KEV is not evidence of safety - Office memory-corruption bugs are historically favored by both commodity malware and targeted actors, and a patch is already available (implying the flaw is disclosed and reverse-engineerable). Verdict: treat as a priority patch given the ubiquity of Excel and full-impact RCE profile, while noting that real-world exploitation likelihood is INFERRED from product history rather than confirmed by EPSS/KEV data present in this input. |
| Exploit ScenarioDerived | An attacker emails a victim a crafted .xlsx/.xls workbook (or hosts it for download) that triggers a heap-based buffer overflow (CWE-122) in Excel's file parser when opened. Because no privileges are required and the vector is network-delivered, successful exploitation yields arbitrary code execution in the context of the user who opened the file. No public exploit identified at time of analysis, so weaponization effort is currently unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
RemediationAI
Apply the Microsoft security update for CVE-2026-97780 immediately - Microsoft confirms a vendor patch is available, with Microsoft Office LTSC 2021 fixed at 16.0.14334.20974, Microsoft Office LTSC 2024 fixed at 16.0.17932.21056, and Office Online Server fixed at 16.0.10417.20228, while Microsoft 365 Apps for Enterprise updates to the current channel build listed at https://aka.ms/OfficeSecurityReleases and the Mac editions (Office 365 for Mac, LTSC for Mac 2021/2024) receive their fixes through Microsoft AutoUpdate once published; full deployment details are in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97780. Until every endpoint and server is patched, reduce exposure by keeping Excel files opened from email, the internet, or untrusted shares in Protected View and Microsoft Defender Application Guard (trade-off: extra friction and occasional rendering limitations for legitimate documents), enforcing Mark-of-the-Web so internet-origin attachments cannot be opened without explicit user consent, and deploying Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes (trade-off: this can break legitimate add-ins, macros, and line-of-business automation, so pilot in audit mode first). Note that macro-blocking policies alone do not mitigate this flaw because the overflow is in the file-format parser, not in VBA execution; disabling the Outlook/Explorer preview pane for Office documents and stripping or quarantining Office attachments at the mail gateway are useful compensating controls but degrade user productivity, and running Office under standard, non-administrative accounts remains an important damage-limitation measure since any exploit executes with the privileges of the user who opens the file.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow in the code Excel uses to parse an attacker-supplied spreadsheet file. Because the overflow is triggered while interpreting file-format structures rather than through macro execution, it is a memory-corruption issue in the Excel parser itself: malformed data causes the parser to write past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or objects that can then be leveraged for controlled code execution within the Excel process. The network attack vector (AV:N) reflects that the weaponized document is delivered over a network - typically as an email attachment, a link to a hosted file, or a previewed document - while UI:R captures the fact that the victim, not the attacker, must open or preview it for the corruption to occur. The unchanged scope (S:U) and high confidentiality, integrity, and availability impacts indicate that a successful exploit gives the attacker the full rights of the signed-in user inside a process that already works with untrusted documents, which is why sandboxing, Protected View, and least-privilege account design materially limit post-exploitation reach; standard OS mitigations such as ASLR, DEP, and CFG raise the bar for reliable exploitation but do not remove the underlying memory-safety defect. The EUVD record (EUVD-2026-99822) and the Microsoft advisory cover the same parsing flaw across the Windows, Mac, and server-side Office code bases, all of which embed the vulnerable component.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is network-delivered but requires the victim to open it, so AV:N with UI:R and PR:N; heap overflow yields full code execution, hence C:H/I:H/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Excel (across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac, and Office Online Server) contains a heap-based buffer overflow that allows an unauthenticated attacker to execute arbitrary code when a user opens or previews a specially crafted spreadsheet. Although no public exploit identified at time of analysis, the broad default installation base and phishing-based delivery vector mean any employee could be targeted, potentially leading to data compromise or system takeover at the user's privilege level. Leadership should prioritize patching to prevent a potential widespread incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB